rlz_lib_win.cc 6.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211
  1. // Copyright (c) 2012 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. //
  5. // A library to manage RLZ information for access-points shared
  6. // across different client applications.
  7. #include "rlz/lib/machine_deal_win.h"
  8. #include <windows.h>
  9. #include <aclapi.h>
  10. #include <stddef.h>
  11. #include <winerror.h>
  12. #include <memory>
  13. #include "base/win/registry.h"
  14. #include "rlz/lib/assert.h"
  15. #include "rlz/lib/rlz_value_store.h"
  16. #include "rlz/win/lib/machine_deal.h"
  17. #include "rlz/win/lib/rlz_value_store_registry.h"
  18. namespace rlz_lib {
  19. // OEM Deal confirmation storage functions.
  20. template<class T>
  21. class typed_buffer_ptr {
  22. std::unique_ptr<char[]> buffer_;
  23. public:
  24. typed_buffer_ptr() {
  25. }
  26. explicit typed_buffer_ptr(size_t size) : buffer_(new char[size]) {
  27. }
  28. void reset(size_t size) {
  29. buffer_.reset(new char[size]);
  30. }
  31. operator T*() {
  32. return reinterpret_cast<T*>(buffer_.get());
  33. }
  34. };
  35. // Check if this SID has the desired access by scanning the ACEs in the DACL.
  36. // This function is part of the rlz_lib namespace so that it can be called from
  37. // unit tests. Non-unit test code should not call this function.
  38. bool HasAccess(PSID sid, ACCESS_MASK access_mask, ACL* dacl) {
  39. if (dacl == NULL)
  40. return false;
  41. ACL_SIZE_INFORMATION info;
  42. if (!GetAclInformation(dacl, &info, sizeof(info), AclSizeInformation))
  43. return false;
  44. GENERIC_MAPPING generic_mapping = {KEY_READ, KEY_WRITE, KEY_EXECUTE,
  45. KEY_ALL_ACCESS};
  46. MapGenericMask(&access_mask, &generic_mapping);
  47. for (DWORD i = 0; i < info.AceCount; ++i) {
  48. ACCESS_ALLOWED_ACE* ace;
  49. if (GetAce(dacl, i, reinterpret_cast<void**>(&ace))) {
  50. if ((ace->Header.AceFlags & INHERIT_ONLY_ACE) == INHERIT_ONLY_ACE)
  51. continue;
  52. PSID existing_sid = reinterpret_cast<PSID>(&ace->SidStart);
  53. DWORD mask = ace->Mask;
  54. MapGenericMask(&mask, &generic_mapping);
  55. if (ace->Header.AceType == ACCESS_ALLOWED_ACE_TYPE &&
  56. (mask & access_mask) == access_mask && EqualSid(existing_sid, sid))
  57. return true;
  58. if (ace->Header.AceType == ACCESS_DENIED_ACE_TYPE &&
  59. (mask & access_mask) != 0 && EqualSid(existing_sid, sid))
  60. return false;
  61. }
  62. }
  63. return false;
  64. }
  65. bool CreateMachineState() {
  66. LibMutex lock;
  67. if (lock.failed())
  68. return false;
  69. base::win::RegKey hklm_key;
  70. if (hklm_key.Create(HKEY_LOCAL_MACHINE,
  71. RlzValueStoreRegistry::GetWideLibKeyName().c_str(),
  72. KEY_ALL_ACCESS | KEY_WOW64_32KEY) != ERROR_SUCCESS) {
  73. ASSERT_STRING("rlz_lib::CreateMachineState: "
  74. "Unable to create / open machine key.");
  75. return false;
  76. }
  77. // Create a SID that represents ALL USERS.
  78. DWORD users_sid_size = SECURITY_MAX_SID_SIZE;
  79. typed_buffer_ptr<SID> users_sid(users_sid_size);
  80. CreateWellKnownSid(WinBuiltinUsersSid, NULL, users_sid, &users_sid_size);
  81. // Get the security descriptor for the registry key.
  82. DWORD original_sd_size = 0;
  83. ::RegGetKeySecurity(hklm_key.Handle(), DACL_SECURITY_INFORMATION, NULL,
  84. &original_sd_size);
  85. typed_buffer_ptr<SECURITY_DESCRIPTOR> original_sd(original_sd_size);
  86. LONG result = ::RegGetKeySecurity(hklm_key.Handle(),
  87. DACL_SECURITY_INFORMATION, original_sd, &original_sd_size);
  88. if (result != ERROR_SUCCESS) {
  89. ASSERT_STRING("rlz_lib::CreateMachineState: "
  90. "Unable to create / open machine key.");
  91. return false;
  92. }
  93. // Make a copy of the security descriptor so we can modify it. The one
  94. // returned by RegGetKeySecurity() is self-relative, so we need to make it
  95. // absolute.
  96. DWORD new_sd_size = 0;
  97. DWORD dacl_size = 0;
  98. DWORD sacl_size = 0;
  99. DWORD owner_size = 0;
  100. DWORD group_size = 0;
  101. ::MakeAbsoluteSD(original_sd, NULL, &new_sd_size, NULL, &dacl_size,
  102. NULL, &sacl_size, NULL, &owner_size,
  103. NULL, &group_size);
  104. typed_buffer_ptr<SECURITY_DESCRIPTOR> new_sd(new_sd_size);
  105. // Make sure the DACL is big enough to add one more ACE.
  106. typed_buffer_ptr<ACL> dacl(dacl_size + SECURITY_MAX_SID_SIZE);
  107. typed_buffer_ptr<ACL> sacl(sacl_size);
  108. typed_buffer_ptr<SID> owner(owner_size);
  109. typed_buffer_ptr<SID> group(group_size);
  110. if (!::MakeAbsoluteSD(original_sd, new_sd, &new_sd_size, dacl, &dacl_size,
  111. sacl, &sacl_size, owner, &owner_size,
  112. group, &group_size)) {
  113. ASSERT_STRING("rlz_lib::CreateMachineState: MakeAbsoluteSD failed");
  114. return false;
  115. }
  116. // If all users already have read/write access to the registry key, then
  117. // nothing to do. Otherwise change the security descriptor of the key to
  118. // give everyone access.
  119. if (HasAccess(users_sid, KEY_ALL_ACCESS, dacl)) {
  120. return false;
  121. }
  122. // Add ALL-USERS ALL-ACCESS ACL.
  123. EXPLICIT_ACCESS ea;
  124. ZeroMemory(&ea, sizeof(EXPLICIT_ACCESS));
  125. ea.grfAccessPermissions = GENERIC_ALL | KEY_ALL_ACCESS;
  126. ea.grfAccessMode = GRANT_ACCESS;
  127. ea.grfInheritance= SUB_CONTAINERS_AND_OBJECTS_INHERIT;
  128. ea.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
  129. ea.Trustee.ptstrName = const_cast<wchar_t*>(L"Everyone");
  130. ACL* new_dacl = NULL;
  131. result = SetEntriesInAcl(1, &ea, dacl, &new_dacl);
  132. if (result != ERROR_SUCCESS) {
  133. ASSERT_STRING("rlz_lib::CreateMachineState: SetEntriesInAcl failed");
  134. return false;
  135. }
  136. BOOL ok = SetSecurityDescriptorDacl(new_sd, TRUE, new_dacl, FALSE);
  137. if (!ok) {
  138. ASSERT_STRING("rlz_lib::CreateMachineState: "
  139. "SetSecurityDescriptorOwner failed");
  140. LocalFree(new_dacl);
  141. return false;
  142. }
  143. result = ::RegSetKeySecurity(hklm_key.Handle(),
  144. DACL_SECURITY_INFORMATION,
  145. new_sd);
  146. // Note that the new DACL cannot be freed until after the call to
  147. // RegSetKeySecurity().
  148. LocalFree(new_dacl);
  149. bool success = true;
  150. if (result != ERROR_SUCCESS) {
  151. ASSERT_STRING("rlz_lib::CreateMachineState: "
  152. "Unable to create / open machine key.");
  153. success = false;
  154. }
  155. return success;
  156. }
  157. bool SetMachineDealCode(const char* dcc) {
  158. return MachineDealCode::Set(dcc);
  159. }
  160. bool GetMachineDealCodeAsCgi(char* cgi, size_t cgi_size) {
  161. return MachineDealCode::GetAsCgi(cgi, cgi_size);
  162. }
  163. bool GetMachineDealCode(char* dcc, size_t dcc_size) {
  164. return MachineDealCode::Get(dcc, dcc_size);
  165. }
  166. // Combined functions.
  167. bool SetMachineDealCodeFromPingResponse(const char* response) {
  168. return MachineDealCode::SetFromPingResponse(response);
  169. }
  170. } // namespace rlz_lib